CVE-2021-20357: XSS
IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194963.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20357?
CVE-2021-20357 is a vulnerability in IBM Global Configuration Management that allows for cross-site scripting.
What is the severity level of CVE-2021-20357?
The severity level of CVE-2021-20357 is medium with a CVSS score of 5.4.
Which IBM products are affected by CVE-2021-20357?
IBM Engineering Workflow Management (EWM) versions 7.0.2 and below, IBM Rational Team Concert (RTC) versions 6.0.2, 6.0.6, and 6.0.6.1, IBM Requirements Management DOORS Next (RDNG) versions 6.0.2, 6.0.6, and 6.0.6.1, and IBM Global Configuration Management are affected by CVE-2021-20357.
How does CVE-2021-20357 impact users?
CVE-2021-20357 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
How can I fix the CVE-2021-20357 vulnerability?
Apply the necessary security patches provided by IBM for the affected products to mitigate the CVE-2021-20357 vulnerability.